Unscored severity · published Jun 2, 2005
CVE-2005-1824
The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "\" (backslash) character, which is used as an escape…
–
CVSS
1.1%
EPSS
No
On KEV
Description
The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "\" (backslash) character, which is used as an escape character and makes the module vulnerable to SQL injection attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mailutils · Gnu
1.0.6.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1824
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308031
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200506-02.xml
More from Mailutils
7.8
CVE-2019-18862
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode
–
CVE-2005-2878
Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the…
–
CVE-2005-1522
The imap4d server for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows authenticated remote users to cause a denial of service (CPU consumption) via a large…
–
CVE-2005-1523
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string…
–
CVE-2005-1520
Buffer overflow in the header_get_field_name function in header.c for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary…